调用SSO,实现单点登陆

本次用的SSO是 CAS的官网：http://www.jasig.org/cas
如何搭建SSO server请查看： http://www.micmiu.com/enterprise-app/sso/sso-cas-sample/或自行google

这里只介绍应用如何用已搭建好的SSO。

1. 在pom.xml中加入3.4.1 jasig CAS client,一开始用的3.1.12,但是因为要用到排除一些url不经SSO的功能，所以选择此版本
      <!-- cas -->
      <dependency>
          <groupId>org.jasig.cas.client</groupId>
          <artifactId>cas-client-core</artifactId>
          <version>3.4.1</version>
      </dependency>
2. 在web.xml中加入

<!-- ======================== 单点登录开始 ======================== -->
    <!-- 用于单点退出，该过滤器用于实现单点登出功能，可选配置 -->
    <listener>
        <listener-class>org.jasig.cas.client.session.SingleSignOutHttpSessionListener</listener-class>
    </listener>

     该过滤器负责用户的认证工作，必须启用它
    <filter>
        <filter-name>CASFilter</filter-name>
        <filter-class>org.jasig.cas.client.authentication.AuthenticationFilter</filter-class>
        <init-param>
            <param-name>casServerLoginUrl</param-name>
            <param-value>http://sso.yourdomain.cn/cas/login</param-value>
            <!--这里的SSO server是服务端的IP -->
        </init-param>
        <init-param>
            <param-name>serverName</param-name>
            <param-value>http://192.168.11.170:9999</param-value>
        </init-param>
        <init-param>
            <param-name>ignorePattern</param-name>
            <param-value>queryTestFormByCondition</param-value>
        </init-param>
        <init-param>
            <!--CONTAINS,REGEX,EXACT-->
            <param-name>ignoreUrlPatternType</param-name>
            <param-value>CONTAINS</param-value>
        </init-param>
    </filter>
    <filter-mapping>
        <filter-name>CASFilter</filter-name>
        <url-pattern>/*</url-pattern>
    </filter-mapping>

    <filter>
        <filter-name>CAS Single Sign Out Filter</filter-name>
        <filter-class>org.jasig.cas.client.session.SingleSignOutFilter</filter-class>
        <!--这个地方需要设置casServerUrlPrefix，3.1.12可以不设置，但是后面的版本如果没有设置就会抛casServerUrlPrefix cannot be null的异常，编译不通过-->
        <init-param>
            <param-name>casServerUrlPrefix</param-name>
            <param-value>https://cas.example.com/cas</param-value>
        </init-param>
    </filter>

    <filter-mapping>
        <filter-name>CAS Single Sign Out Filter</filter-name>
        <url-pattern>/*</url-pattern>
    </filter-mapping>

    <!-- 该过滤器负责对Ticket的校验工作，必须启用它 -->

    <filter>
        <filter-name>CAS Validation Filter</filter-name>
        <filter-class>
            org.jasig.cas.client.validation.Cas20ProxyReceivingTicketValidationFilter</filter-class>
        <init-param>
            <param-name>casServerUrlPrefix</param-name>
            <param-value>http://sso.yourdomain.cn/cas</param-value>
        </init-param>
        <init-param>
            <param-name>serverName</param-name>
             <!-- 后端服务 -->
            <param-value>http://192.168.11.170:9999</param-value>
        </init-param>
    </filter>
    <filter-mapping>
        <filter-name>CAS Validation Filter</filter-name>
        <url-pattern>/*</url-pattern>
    </filter-mapping>

    <!-- 该过滤器负责实现HttpServletRequest请求的包裹， 比如允许开发者通过HttpServletRequest的getRemoteUser()方法获得SSO登录用户的登录名，可选配置。 -->
    <filter>
        <filter-name>CAS HttpServletRequest Wrapper Filter</filter-name>
        <filter-class>
            org.jasig.cas.client.util.HttpServletRequestWrapperFilter</filter-class>
    </filter>
    <filter-mapping>
        <filter-name>CAS HttpServletRequest Wrapper Filter</filter-name>
        <url-pattern>/*</url-pattern>
    </filter-mapping>

    <!-- 该过滤器使得开发者可以通过org.jasig.cas.client.util.AssertionHolder来获取用户的登录名。 比如AssertionHolder.getAssertion().getPrincipal().getName()。 -->
    <filter>
        <filter-name>CAS Assertion Thread Local Filter</filter-name>
        <filter-class>org.jasig.cas.client.util.AssertionThreadLocalFilter</filter-class>
    </filter>
    <filter-mapping>
        <filter-name>CAS Assertion Thread Local Filter</filter-name>
        <url-pattern>/*</url-pattern>
    </filter-mapping>

    <!-- ======================== 单点登录结束 ======================== -->
    
3. 在controller中添加方法

    @RequestMapping(path="/isLogin",method = RequestMethod.GET)
    public void isLogin(@RequestParam(value="ticket",required = false) String ticket,
                            HttpServletRequest request, HttpServletResponse response)throws IOException {

        AttributePrincipal principal = (AttributePrincipal) AssertionHolder.getAssertion().getPrincipal();

        String checklogin = request.getParameter("checklogin");
        if(null != checklogin || null == principal){

            logger.info("isLogin","登录成功，重定向tds首页");
            //前端页面
            response.sendRedirect("http://localhost:8099/#/");

        }else{

            // 获取其他的登陆信息如下：
            Map map=principal.getAttributes();
            String result = "";
            String  callback = request.getParameter("callback");
            if(null != callback){

                logger.info("isLogin", MessageFormat.format("用户：{0}已登录",map.get("name")));

                JSONObject myJsonObject = new JSONObject();
                myJsonObject.put("name", map.get("name"));
                myJsonObject.put("username", map.get("username"));
                myJsonObject.put("birthday", map.get("birthday"));
                myJsonObject.put("status", map.get("status"));
                myJsonObject.put("avatar", map.get("avatar"));
                myJsonObject.put("idCard", map.get("idCard"));
                myJsonObject.put("password", map.get("password"));
                result = callback + "(" + myJsonObject + ")";
                PrintWriter writer = response.getWriter();
                writer.write(result);
                writer.flush();
                writer.close();
            }
        }
    }

4. 前端调用

let login = function(callback){

  var requestUserUrl =getProtocol('user/isLogin');
    console.log('start login');
    $.ajax({
      type: "GET",
      url: requestUserUrl,
      contentType: "application/json;charset=UTF-8",
      dataType: "jsonp",
      data: JSON.stringify(),
      cache:false,
      success: function (data,status,xhr) {          
          if(data){            
            sessionStorage.setItem('user', JSON.stringify(data));
            callback&&callback(data);
            return;
          }
          callback&&callback(false);
        },
        error:function(XMLHttpRequest, textStatus, errorThrown){
          if("parsererror" === textStatus || "error"===textStatus){
            sessionStorage.removeItem('user');
            window.location.href = 'http://sso.yourdomain.cn/cas/login.html?service=http://192.168.11.170:9999/tds-web/user/isLogin?checklogin=1&redirect='+window.location.href;
          }
          
          callback&&callback(false);
        }
      });
};

有可能会遇到的问题：
1. jasig CAS client 版本问题导致的，在3.1.12版本上，sing out可以不设 casServerUrlPrefix，但是如果你换成更高版本需要设置，否则就会出错误
    <filter>
        <filter-name>CAS Single Sign Out Filter</filter-name>
        <filter-class>org.jasig.cas.client.session.SingleSignOutFilter</filter-class>
        <!--这个地方需要设置casServerUrlPrefix，3.1.12可以不设置，但是后面的版本如果没有设置就会抛casServerUrlPrefix cannot be null的异常，编译不通过-->
        <init-param>
            <param-name>casServerUrlPrefix</param-name>
            <param-value>https://cas.example.com/cas</param-value>
        </init-param>
    </filter>

    <filter-mapping>
        <filter-name>CAS Single Sign Out Filter</filter-name>
        <url-pattern>/*</url-pattern>
    </filter-mapping>
2. XMLHttpRequest cannot load http://10.28.87.30:8080/tds-web/ueditor/exec?action=uploadimage&encode=utf-8. Request header field X_Requested_With is not allowed by Access-Control-Allow-Headers in preflight response.所需做的步骤:
    a. 添加Filter,允许跨域访问
        @Override
    public void doFilter(ServletRequest req, ServletResponse res, FilterChain chain) throws IOException, ServletException {
        HttpServletRequest request = (HttpServletRequest)req;
        HttpServletResponse response = (HttpServletResponse) res;
        response.setContentType("text/html;charset=UTF-8");
        response.setHeader("Access-Control-Allow-Origin", request.getHeader("Origin"));// 授权的源控制request.getHeader("Origin")
        response.setHeader("Access-Control-Allow-Methods", "PUT,POST, GET, OPTIONS, DELETE");// 允许请求的HTTP Method
        response.setHeader("Access-Control-Max-Age", "3600");
        response.setHeader("Access-Control-Allow-Credentials", "true");//控制是否开启与Ajax的Cookie提交方式
        response.setHeader("Access-Control-Allow-Headers", "Origin, No-Cache, X-Requested-With,X_Requested_With, If-Modified-Since, Pragma, Last-Modified, Cache-Control, Expires, Content-Type, X-E4M-With,userId,token,Accept");
        response.setHeader("X-Powered-By","3.2.1");
        response.setHeader("XDomainRequestAllowed","1");
        String method= request.getMethod();
        if (method.equals("OPTIONS")){
            response.setStatus(200);
        }
        chain.doFilter(req, res);
    }
    b. 如果还出现问题Failed to load http://xxx.xxx.xxx.xxx/test Response for preflight is invalid (redirect)，返回的是Method: OPTIONS, 200 OK,，很有可能是因为你所访问的链接被定向到了SSO服务器，而我们又希望有些接口是可以直接访问的，那么就可以通过以下方式设置，在org.jasig.cas.client.authentication.AuthenticationFilter中加入“ignorePattern”，
    而且还可以选择匹配类型，有三种：正则表达式，字符串包含，完全匹配。例如我设置的CONTAINS：
    <filter-class>org.jasig.cas.client.authentication.AuthenticationFilter</filter-class>
        <init-param>
            <param-name>casServerLoginUrl</param-name>
            <param-value>http://sso.yourdomain.cn/cas/login</param-value>
            <!--这里的server是服务端的IP -->
        </init-param>
        <init-param>
            <param-name>serverName</param-name>
            <param-value>http://192.168.11.170:9999</param-value>
        </init-param>
        <init-param>
            <param-name>ignorePattern</param-name>
            <param-value>queryTestFormByCondition</param-value>
        </init-param>
        <init-param>
            <!--CONTAINS,REGEX,EXACT-->
            <param-name>ignoreUrlPatternType</param-name>
            <param-value>CONTAINS</param-value>
        </init-param>
    </filter>